- LOW3.9CVE-2026-34768EPSS 0.01%Electron: Unquoted executable path in app.setLoginItemSettings on Windows
- LOW3.3CVE-2026-34766EPSS 0.01%Electron: USB device selection not validated against filtered device list
- LOW3.7CVE-2026-35648EPSS 0.03%OpenClaw may have stale policy enforcement for queued node actions
- LOW3.1CVE-2026-4874EPSS 0.01%Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
- LOW3.7CVE-2026-4633EPSS 0.02%Keycloak's identity-first login flow exposes user information
- LOW3.7CVE-2026-33490EPSS 0.02%h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
- LOW2.6CVE-2026-22735EPSS 0.09%Spring MVC and WebFlux has Server Sent Event stream corruption
- LOW2.7CVE-2026-32638EPSS 0.03%StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
- LOW2.5CVE-2026-32970EPSS 0.02%OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode
- LOW3.1CVE-2026-2366EPSS 0.01%Keycloak vulnerable to authorization bypass via the Admin API
- LOW2.7CVE-2026-3911EPSS 0.01%Keycloak: Information disclosure of disabled user attributes via administrative endpoint
- LOW3.7CVE-2025-11143EPSS 0.14%org.eclipse.jetty:jetty-http has different parsing of invalid URIs
- LOW2.0CVE-2026-29184EPSS 0.01%@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
- LOW2.7CVE-2026-29185EPSS 0.01%Backstage vulnerable to potential reading of SCM URLs using built in token
- LOW3.7CVE-2026-32067EPSS 0.04%OpenClaw has cross-account DM pairing authorization bypass via unscoped pairing store access
- LOW3.4CVE-2025-68467EPSS 0.02%Dark Reader gives users the ability to request style sheets from local web servers
- LOW3.7CVE-2026-32028EPSS 0.04%OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups
- LOW3.3CVE-2026-3449EPSS 0.02%@tootallnate/once vulnerable to Incorrect Control Flow Scoping
- LOW2.6CVE-2026-32058EPSS 0.04%OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows
- LOW3.3CVE-2026-32020EPSS 0.02%OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read
- LOW3.7CVE-2026-31991EPSS 0.04%OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage
- LOW3.1CVE-2025-12150EPSS 0.01%Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass
- LOW3.3CVE-2026-3293EPSS 0.01%Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner
- LOW3.6CVE-2026-31996EPSS 0.02%OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags
- LOW3.8CVE-2026-2733EPSS 0.03%Keycloak: Missing Check on Disabled Client for Docker Registry Protocol